Damn, which version do you use ? I'm using v2.3 !
Any solution except a new installation of OSSEC ? Thanks ! On 4 fév, 14:38, oscar schneider <[email protected]> wrote: > Hey, > > I copy/pasted your decoder into a test environment and ran ossec-logtest. > Here it seems to work fine: > > 2010/02/04 14:36:05 ossec-testrule: INFO: Started (pid: 31105). > ossec-testrule: Type one log per line. > > Feb 1 15:51:45 192.168.1.1 > > **Phase 1: Completed pre-decoding. > full event: 'Feb 1 15:51:45 192.168.1.1' > hostname: 'myhost' > program_name: '(null)' > log: 'Feb 1 15:51:45 192.168.1.1' > > **Phase 2: Completed decoding. > decoder: 'admail' > srcip: '192.168.1.1
